ci: add CodeQL, Safety CVE scan, and Bandit rules to CI

[raajheshkannaa]

Why

• Static analysis missing – the project doesn’t yet run CodeQL.
• Supply-chain CVE checks missing – Safety scan adds an automated alert if any dependency has a reported CVE.
• Security lint – Ruff is already in use, but Bandit rules (--select B) were not enabled.

What’s in this PR

Added / Changed	Purpose
.github/workflows/codeql.yml	Runs GitHub CodeQL (Python) on push / PR.
Updated .github/workflows/ruff.yml	Adds two steps • Bandit rules via ruff --select B • Safety CVE scan job (uploads report artifact)
(no other files touched)	No functional code changes.

Impact

• Immediate SAST coverage (CodeQL) and CVE reporting (Safety) for every PR.
• Zero runtime impact; CI-only additions.
• Bandit rules catch insecure code patterns early.

Happy to maintain these security workflows going forward—feedback welcome!

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[coveralls]

Pull Request Test Coverage Report for Build 16610817334

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 97.482%

---

Totals
Change from base Build 16548658975:	0.0%
Covered Lines:	7114
Relevant Lines:	7287

---

💛 - Coveralls

[stevepiercy]

I don't see the point in adding these duplicative features, and it increases CI run times, consuming more electricity, without need. I could be wrong, and if so, there needs to be a good explanation for why this is needed, especially since it is a product from the contributor's employer. It's irresponsible not to disclose that up front, too.

[raajheshkannaa]

@stevepiercy Thanks for taking the time to review this. I understand the extra checks don’t fit the project’s current CI goals, so I’m withdrawing the proposal.

(For clarity: the defensive-works org on my fork is just my personal namespace—there’s no company or product endorsement involved.)

Appreciate the quick feedback, and best of luck with the next release!

(Closing this PR to avoid further noise.)